Privacy Policy

Read this first — non-negotiable clauses

These provisions describe how Complisto handles the data flows required to run the product. They apply in addition to (and override any conflicting language in) the pasted Termly body below.

Google OAuth data flow

When you sign in with Google, Complisto receives — via Google's OAuth 2.0 flow — your email address, display name, and profile picture URL. We use these fields solely to identify your session, display your identity in-product, and associate scans with your account. We do not sell this data, do not use it for advertising, and do not share it with third parties except processors necessary to operate the service (see “Sub-processors” below).

What we store

• Authentication identity from Supabase Auth (id, email, provider).
• Business profile you enter on a scan (business name, address, vertical, evidence attestations).
• Scan and finding records tied to your user id when you are signed in; anonymous scans are stored without a user id.
• Server logs (IP, user agent, timestamps) for security and abuse prevention.

Retention

Authenticated scan records are retained for the life of your account plus thirty (30) days after account deletion request. Anonymous scans are retained for ninety (90) days. Server logs are rotated within thirty (30) days. You may request deletion at any time — see “Your rights” below.

Your rights

Subject to applicable law (including GDPR and CCPA where they apply), you may request access to, correction of, or deletion of your personal data by emailing privacy@complisto.com. We respond within thirty (30) days.

Sub-processors

• Supabase — authentication and Postgres storage (US).
• Google — OAuth 2.0 identity provider (per Google's own privacy terms).
• Hostinger — application hosting (VPS).
• Resend — transactional email delivery (planned; not yet active).

No ads, no sale of personal data

[LEGAL_ENTITY_NAME] does not run advertising, does not participate in ad networks, and does not sell personal data to third parties.